WDH-083 Websites, Domains & Internet Infrastructure
Can I prove somebody downloaded a file from a website?¶
Server and device records may strongly support that a file was transferred to a device or account, but who initiated it and what happened next require interpretation.
Evidence to consider¶
- server transfer records;
- complete or partial file;
- download history;
- file size and hash;
- storage location;
- open, rename or sharing activity;
- account, browser profile and device user.
Interpret the result carefully¶
Technical records may identify a service, account, device or request rather than the person responsible. Preserve exact dates, times and time zones, and test shared access, automation, compromise and changing infrastructure where relevant.
Key takeaway
Distinguish file transfer from deliberate acquisition, possession, opening, knowledge and intent.